Merge pull request #1993 from aembler/hotfix/private-messages

Fixing error marking a message as read; fixing error with reply disclosing too much.
concretecms · Feb 26, 2019 · 150aa36 · 150aa36
2 parents bb957f1 + 385c006
commit 150aa36
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/web/concrete/core/controllers/single_pages/profile/messages.php b/web/concrete/core/controllers/single_pages/profile/messages.php
@@ -123,6 +123,16 @@ public function reply($boxID, $msgID) {
 		$msg = UserPrivateMessage::getByID($msgID);
 		$uID = $msg->getMessageRelevantUserID();
 		$this->validateUser($uID);
+
+        // Make sure we are allowed to view this
+        $viewingUser = new User();
+        $viewingUserInfo = UserInfo::getByID($viewingUser->getUserID());
+        $isSentToUser = (int) $msg->getMessageUserToID() == (int) $viewingUserInfo->getUserID();
+        if (!$isSentToUser && !$viewingUserInfo->canReadPrivateMessage($msg)) {
+            $this->redirect('/profile/messages');
+            return;
+        }
+
 		$this->set('backURL', View::url('/profile/messages', 'view_message', $boxID, $msgID));
 		$this->set('msgID', $msgID);
 		$this->set('box', $boxID);

diff --git a/web/concrete/core/models/user_private_message.php b/web/concrete/core/models/user_private_message.php
@@ -74,7 +74,7 @@ public function markAsRead() {
 			$db = Loader::db();
 			if ($this->uID != $this->uAuthorID) {
 				Events::fire('on_private_message_marked_as_read', $this);
-				$db->Execute('update UserPrivateMessagesTo set msgIsUnread = 0 where msgID = ?', array($this->msgID, $this->msgMailboxID, $this->uID));
+				$db->Execute('update UserPrivateMessagesTo set msgIsUnread = 0 where msgID = ?', array($this->msgID));
 			}
 		}